Metadata-Version: 2.4
Name: harar
Version: 0.3.0
Summary: harar's client: from harar import vault. Where each secret may go, and the secret itself for one host only.
Project-URL: Homepage, https://harar.addis.gg
Project-URL: Source, https://github.com/addiscorp/harar
License-Expression: Apache-2.0
License-File: LICENSE
Requires-Python: >=3.9
Description-Content-Type: text/markdown

# harar

harar's client for Python.

```python
from harar import vault

# The harar agent on this machine (`harar agent`): no account, no token.
harar = vault()

# A harar:// reference names a vault key, as op:// names a 1Password field.
key = harar.secrets.resolve("harar://prod/shop/STRIPE_KEY")
a, b = harar.secrets.resolve_all(["harar://prod/shop/STRIPE_KEY", "harar://prod/site/DATABASE_URL"])
```

The value is read when you ask for it and held only by your program; nothing
is written to disk. The agent answers only the user it runs as, and the first
time a terminal asks, it asks you to approve (Touch ID on a Mac).
`vault(socket="/run/harar.sock")` talks to a primary instead.

A gateway that attaches keys on their way out (`import { gateway } from
'rixse'`) asks where each may go, and for it for one host only:
`hosts(secret)` and `send(secret, host)`. A refusal, or a harar that cannot be reached, raises `harar.HararError` naming why.

harar itself: https://github.com/addiscorp/harar
